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Amendment to the Claims : 

This listing of claims replaces all prior versions, and 
listings, of claims in the application: 

1. (Previously Presented) A method comprising: 
determining at a first classifying forwarding element if a 

classification parameter is available for Internet Protocol 
security (IPsec) traffic that indicates a route for the IPsec 
traffic and classifying said traffic if available; 

if said classification parameter is not available, and the 
IPsec traffic is encrypted then decrypting traffic in a 
decrypting forwarding element separate from the first 
classifying forwarding element after said traffic has passed 
through said classifying forwarding element, and determining the 
classification parameter for the IPsec traffic ; 

forwarding the IPsec traffic based on the classification 
parameter ; and 

providing the classification parameter to the first 
classifying forwarding element. 

2 . (Previously Presented) The method of claim 1 further 
comprising receiving the IPsec traffic at the classifying 
forwarding element. 
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3. (Original) The method of claim 1 in which the 
classif ication parameter includes a security parameter index 
(SPI) associated with the IPsec traffic. 

4. (Original) The method of claim 1 in which the IPsec 
traffic includes a data packet. 

5 . (Previously Presented) The method of claim 1 further 
comprising receiving at the first classifying forwarding element 
other IPsec traffic included in a traffic stream with the IPsec 
traffic, and further comprising forwarding the other IPsec 
traffic based on the provided classification parameter. 

6. (Previously Presented) An article comprising: 

a machine-readable medium which stores machine-executable 
instructions, the instructions causing a machine to: 

determine at a first mechanism if a classification 
parameter is available for Internet Protocol security (IPsec) 
traffic that indicates a route for the IPsec traffic; 

if a classification parameter is not available, 
sending said traffic to a second mechanism separate from the 
first mechanism after said traffic has passed said first 
mechanism, and which second mechanism decrypts the IPsec traffic 
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if the IPsec traffic is encrypted and determine the 
classification parameter for the IPsec traffic 

forward the IPsec traffic based on the classification 
parameter; and 

provide the classification parameter to the first 
mechanism. 

7. (Original) The article of claim 6 further causing a 
machine to receive the IPsec traffic at the first mechanism. 

8. (Original) The article of claim S in which the 
classification parameter includes a security parameter index 
(SPI) associated with the IPsec traffic. 

9. (Original) The article of claim 5 in which the IPsec 
traffic includes a data packet. 

10. (Previously Presented) The article of claim 6 further 
causing the first mechanism to forward other IPsec traffic 
included in a traffic stream with the IPsec traffic based on the 
provided classification parameter. 

11. (Currently Amended) A system comprising: 

a classifying forwarding element configured to communicate 
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with a network, to determine if a classification parameter that 
indicates a route for a traffic stream is available for a packet 
included in the traffic stream; 

a control element in communication with the classifying 
forwarding element, the control element configured to receive 
information including classification information for the traffic 
stream and cryptographic information for the traffic stream, the 
control element further configured to transmit at least some 
classification information to the classifying forwarding element 
and to transmit at least one key based on the cryptographic 
information to a dc oryp t i o n decryp t ing forwarding element 
separate from the classifying forwarding element; and 

wherein the dcorypti - of K ie crypt ing forwarding element is 
configured to receive the packet from the classifying forwarding 
element, and to perform an encryption-related procedure on the 
packet if the packet is encrypted and associated with the at 
least one key. 

12. (Previously Presented) The system of claim 11 wherein 
the control element is configured to receive at least some of 
the cryptographic information in an Internet Key Exchange 
packet . 
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. 13 • (Currently Amended) The system of claim 12 in which 
the oooond mcchanio m decrypting forwarding element is also 
configured to forward the packet to the control element if the 
packet is not associated with a known encrypt ion-related key. 

14 . (Currently Amended) The system of claim 12, wherein 
the decrypt io n decrypting forwarding element is included in a 
plurality of decrypt ion decrypting forwarding elements, each in 
communication with at least one server of a plurality of 
servers, and wherein the control element includes security 
information for each of the plurality of servers. 

15. (Currently Amended) The system of claim 12, wherein 
the cryptographic information includes an encryption-related 
key. 

16. (Cancelled) 

17. (Currently Amended) The system of claim 11 further 
comprising a plurality of additional mechanisms, each additional 
mechanism configured to communicate with the 

claooi - f ioatio n classifying forwarding dcvico element to perform an 
encryption- related procedure on the packet if the packet is 
encrypted and associated with a known encryption-related key, 
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and, if the classification parameter is available, to forward 
the packet based on the route for the traffic stream. 

18. (Original) The system of claim 11 in which the packet 
includes an Internet Protocol security data packet. 

19. (Original) The system of claim 11 in which the traffic 
stream includes a plurality of Internet Protocol security data 
packets. 

20. (Currently Amended) The system of claim 11 in which 
the firot mcchanio m classifying forwarding element is also 
configured to forward the packet to the second 
mochan - jkrt ft decrypting forwarding element if the packet is 
encrypted. 

21. (Original) The system of claim 1L in which the route 
for the traffic stream includes a route through a network. 

22. (Original) The system of claim 21 in which the network 
includes an Internet. 

23. (Previously Presented) The system of claim 11 in 
which the encryption- related procedure includes encrypting the 
packet . 
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24. (Previously Presented) The system of claim 11 in 
which the encryption- related procedure includes decrypting the 
packet . 

25. (Currently Amended) The system of claim 11 further 
comprising another mechanism configured to receive the packet 
from the second - mQchanio m decrypting forwarding element and to 
forward the packet based on the route to an ultimate destination 
of the packet. 

26. (Currently Amended) The system of claim 11 in which 
the firot mQchanio m claBsifying forwarding element is also 
configured to route packets included in the traffic stream based 
on a load balancing scheme . 

27-30. (Cancelled) 
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